Hi everyone! After upgrading to version 3.8.1, I got a bunch of errors: In the Security Content i get the following:    app/Splunk_Security_Essentials/security_content 404 (Not Found)Understand this errorAI web-client-content-script.js:2 Uncaught (in promise) Error: Access to storage is not allowed from this context.   On the Data Inventory page i get the following: Error! Received the following error: Description Message Error occurred while grabbing data_inventory_products   Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_Security_Essentials/bin/generateShowcaseInfo.py", line 473, in handle if row['stage'] in ['all-done', 'step-review', 'step-eventsize', 'step-volume', 'manualnodata']: KeyError: 'stage'   There are also a couple of apps: splunk_essentials_8_2 and splunk_essentials_9_0 are both enabled. Does anyone know how to fix this? Thanks! ... View more

Hi folks! I want to create a custom GeneratingCommand that makes a simple API request, but how do I save the API key in passwords.conf? I have a default/setup.xml file with the following content:   <setup> <block title="Add API key(s)" endpoint="storage/passwords" entity="_new"> <input field="password"> <label>API key</label> <type>password</type> </input> </block> </setup>   But when I configure the app, the password (API key) is not saved in the app folder (passwords.conf). And if I need to add several api keys, how can I assign names to them and get information from the storage? I doubt this code will work:   try: app = "app-name" settings = json.loads(sys.stdin.read()) config = settings['configuration'] entities = entity.getEntities(['admin', 'passwords'], namespace=app, owner='nobody', sessionKey=settings['session_key']) i, c = entities.items()[0] api_key = c['clear_password'] #user, = c['username'], c['clear_password'] except Exception as e: yield {"_time": time.time(), "_raw": str(e)} self.logger.fatal("ERROR Unexpected error: %s" % e)     ... View more

Hi everyone, I have configured otx alienvault taxii source in Threat Intelligence Management , as I can see in logs some data was downloaded successfully, but is there a way to know which data exactly? ... View more

Hi everyone! Is it possible to pass a parameter from search to the next "action|url" step? Like in description: $result$ if not, is it possible to somehow change this behavior by modifying this next step, if yes, then how? Thanks. ... View more

Hello everyone! How can we solve the problem of searching for secrets in all or some splunk indexes so that splunk is not heavily loaded: how can this be implemented? (approach).  It is obvious that the list of indexes needs to be limited. What else? ... View more

Hi, If you make a curl request to the Splunk, that in the web_access.log the client is a 127.0.0.1 and user is '-', can we somehow correct client field to know who actually made the request? ... View more

Hello everyone, I'm new to Splunk and I have a question: is it possible to update the custom reporting command code without restarting Splunk? "After modifying configuration files on disk, you need to restart Splunk Enterprise. This step is required for your updates to take effect. For information on how to restart Splunk Enterprise, see Start and stop Splunk Enterprise in the Splunk Enterprise Admin Manual." I mean... How can I debug my app if I have to reload the Splunk every time I changed something? ... View more

Hello everyone, I'm new to Splunk, can anyone help me: enable "Using visualizations to determine TTP coverage" from https://lantern.splunk.com/?title=Security%2FUCE%2FGuided_Insights%2FCyber_frameworks%2FAssessing_and_expanding_MITRE_ATT%26CK_coverage_in_Splunk_Enterprise_Security# ? https://docs.splunk.com/Documentation/ES/7.1.0/RBA/ViewMitreMatrixforRiskNotable#View_the_MITRE_ATT.... Splunk Enterprise Security Splunk Security Essentials  ... View more